Security Affairs

MARCH 8, 2024

QNAP addressed three vulnerabilities in its NAS products that can be exploited to access devices. Below is the list of the vulnerable versions and the versions released by the Taiwanese vendor to address the issues: Affected Product Fixed Version QTS 5.1.x x QTS 5.1.3.2578 build 20231110 and later QTS 4.5.x

Authentication 121

Authentication IT Access Security 121

Security Affairs

MARCH 12, 2024

Microsoft Patch Tuesday security updates for March 2024 addressed 59 security vulnerabilities in its products, including RCE flaws. Microsoft released Patch Tuesday security updates for March 2023 that address 59 security vulnerabilities in its products.

Security 117

Security Authentication Access IT 117

Security Affairs

MARCH 22, 2024

The complete list of results for the first Two of the Pwn2Own Vancouver 2024 hacking competition is available here: [link] Vendors have 90 days to address the vulnerabilities exploited by the participants during the Pwn2Own hacking competition before TrendMicro’s Zero Day Initiative publicly discloses the issues.

Information Security 130

Information Security IT Security 130

Security Affairs

APRIL 16, 2024

The company’s product range includes bipolar transistors, diodes, ESD protection, TVS diodes, MOSFETs, and logic devices. The Dark Angels ransomware group added Nexperia to the list of victims on its Tor leak site. It has front-end factories in Hamburg, Germany, and Greater Manchester, England. pst files - 1.5

Ransomware 111

Ransomware Manufacturing Insurance Cybersecurity 111

Security Affairs

DECEMBER 30, 2023

The company’s Document Technology segment offers desktop monochrome and color printers, multifunction printers, copiers, digital printing presses, and light production devices; and production printing and publishing systems for the graphic communications marketplace and large enterprises.

Ransomware 124

Ransomware Data breaches Communications IT 124

Security Affairs

MARCH 20, 2024

Atlassian fixed tens of vulnerabilities in Bamboo, Bitbucket, Confluence, and Jira products, including a critical flaw that can be very dangerous. Atlassian addressed multiple vulnerabilities in its Bamboo, Bitbucket, Confluence, and Jira products. The complete list of vulnerabilities addressed by Atlassian is available here.

IT 125

IT Information Security Security 125

Krebs on Security

NOVEMBER 2, 2023

SWAT takes a percentage cut (up to 50 percent) where “ stuffers ” — thieves armed with stolen credit card numbers — pay a portion of each product’s retail value to SWAT as the reshipping fee. The contact information for Kareem , a young man from Maryland, was listed as an active drop.

Marketing 271

Marketing Retail Blockchain Communications 271

KnowBe4

JANUARY 20, 2024

The Breach and Attack The attack involved Russian hackers using a password spray attack to access a legacy non-production test tenant account at Microsoft. Password spraying is a brute force technique where attackers attempt to log in using a list of potential usernames and passwords.

Passwords 100

Passwords Cybersecurity Access IT 100

Krebs on Security

APRIL 4, 2024

co — was being wrongly flagged by MetaMask’s “eth-phishing-detect” list as malicious. “We filed a lawsuit with a lawyer for dishonestly adding a site to the block list, damaging reputation, as well as ignoring the moderation department and ignoring answers!” ” fory66399 threatened.

Phishing 216

Phishing Blockchain Manufacturing Encryption 216

Security Affairs

FEBRUARY 18, 2024

ESET addressed a high-severity vulnerability, tracked as CVE-2024-0353 (CVSS score 7.8), in its Windows products. Below is the list of impacted programs and versions: ESET NOD32 Antivirus, Internet Security, Smart Security Premium, Security Ultimate 16.2.15.0 The company recommended customers patch their products as soon as possible.

Cybersecurity 136

Cybersecurity Security IT Information Security 136

Hunton Privacy

SEPTEMBER 26, 2023

The Act also provides that, if a child’s parent or legal guardian does not affirmatively consent to the terms of service or other contract, the operator shall deny the child access to or use of the online web site, service, or product, and requires sending written confirmation of consent to the parent or legal guardian.

Access 72

Access Personal data Privacy 72

Security Affairs

FEBRUARY 7, 2024

The affected products are: FortiSIEM version 7.1.0 The CERT-EU also published an advisory for the above vulnerabilities: “In February 2024, Fortinet quietly updated a 2023 advisory, joining two critical flows to the list of OS Command vulnerabilities affecting its FortiSIEM product. through 7.1.1 FortiSIEM version 7.0.0

Cybersecurity 122

Cybersecurity IT Information Security Security 122

Security Affairs

APRIL 12, 2024

Credential stuffing is a type of attack in which hackers use automation and lists of compromised usernames and passwords to defeat authentication and authorization mechanisms, with the end goal of account takeover (ATO) and/or data exfiltration.” ” reads the press release published by the company.

Passwords 110

Passwords Security Authentication Data breaches 110

Security Affairs

JANUARY 25, 2024

Cisco addressed a critical flaw in its Unified Communications and Contact Center Solutions products that could lead to remote code execution. Cisco released security patches to address a critical vulnerability, tracked as CVE-2024-20253 (CVSS score of 9.9), impacting multiple Unified Communications and Contact Center Solutions products.

Communications 120

Communications IT Access Security 120

Security Affairs

OCTOBER 30, 2021

MITRE and CISA announced the release of the “2021 Common Weakness Enumeration (CWE) Most Important Hardware Weaknesses” list. MITRE and the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) have announced the release of the “2021 Common Weakness Enumeration (CWE) Most Important Hardware Weaknesses” list. Pierluigi Paganini.

Manufacturing 142

Manufacturing Education Access Security 142

The Last Watchdog

JANUARY 31, 2024

The funding will be used for core research and development to build new AI technology and products to protect against generative AI threats, such as deepfake social engineering and autonomous fraud. While billions have been spent on security products, the impact of cybercrime has actually been getting worse.

Artificial Intelligence 100

Artificial Intelligence Education Cybersecurity Analytics 100

Krebs on Security

FEBRUARY 26, 2020

Today, Zyxel acknowledged the same flaw is present in many of its firewall products. Alex Holden , the security expert who first spotted the code for sale, said at the time the vulnerability was so “stupid” and easy to exploit that he wouldn’t be surprised to find other Zyxel products were similarly affected.

IT 257

IT Sales Ransomware IoT 257

eSecurity Planet

FEBRUARY 19, 2024

While this week was a little light on vulnerability news, it’s still been significant, with Microsoft’s Patch Tuesday happening as well as updates for major products, like Zoom. Also keep an eye on the last few weeks’ vulnerability recaps, especially because we’ve seen repeat products that continue to be exploited.

Ransomware 98

Ransomware Cybersecurity Access Passwords 98

Security Affairs

FEBRUARY 14, 2024

Adobe Patch Tuesday security updates for February 2024 addressed more than 30 vulnerabilities in multiple products, including critical issues. Adobe Patch Tuesday security updates released by Adobe addressed over 30 vulnerabilities across various products, including critical issues. ” reads the advisory.

Authentication 122

Authentication Ransomware Security 122

Security Affairs

DECEMBER 6, 2023

Australian Software giant Atlassian addressed four critical Remote Code Execution (RCE) vulnerabilities in its products. Atlassian released security patches to address four critical remote code execution vulnerabilities in its products. A remote attacker can trigger the flaw in low-complexity attacks without any user interaction.

IT 108

IT Libraries Security Information Security 108

Security Affairs

FEBRUARY 19, 2022

CISA has created a list of free cybersecurity tools and services that can help organizations increase their resilience. The list is part of an ongoing project, it will be continuously updated by CISA that also plans to allow third parties to propose their resources to include in the list. Pierluigi Paganini.

Cybersecurity 137

Cybersecurity Risk Government Security 137

Security Affairs

OCTOBER 14, 2023

” CISA also published a list of misconfigurations and weaknesses known to be exploited in ransomware attacks. This list will guide organizations to quickly identify services known to be used by ransomware threat actors so they can implement mitigations or compensating controls. ” reads the announcement.

Ransomware 104

Ransomware Manufacturing Education Risk 104

Security Affairs

SEPTEMBER 21, 2022

Federal Communications Commission (FCC) has added more Chinese telecom firms to the Covered List. Federal Communications Commission (FCC) has added Pacific Network Corp, ComNet (USA) LLC, and China Unicom (Americas) Operations Limited, to the Covered List. SecurityAffairs – hacking, Covered List). national security. .”

Communications 86

Communications Risk Government Information Security 86

Security Affairs

NOVEMBER 15, 2023

Enterprise software giant SAP addressed a critical improper access control vulnerability in its Business One product. The most severe “hot news” is an improper access control vulnerability, tracked as CVE-2023-31403 (CVSS score of 9.6), that impacts SAP Business One product installation. ” reads the advisory.

Authentication 110

Authentication Access Security IT 110

Security Affairs

SEPTEMBER 24, 2023

The Alphv ransomware group added Clarion, the global manufacturer of audio and video equipment for cars and other vehicles, to the list of victims on its Tor leak site. The company develops, manufactures, and sells a wide range of products, including car navigation systems, audio systems, video systems, and rearview cameras.

Manufacturing 119

Manufacturing Ransomware Data breaches Risk 119

Security Affairs

DECEMBER 13, 2023

Microsoft Patch Tuesday security updates for December 2023 addressed 33 vulnerabilities in multiple products, including a zero-day. Microsoft Patch Tuesday security updates for December 2023 addressed 33 vulnerabilities in multiple products. Successful exploitation of the flaw could allow the disclosure of NTLM hashes.

Security 114

Security IT 114

Security Affairs

NOVEMBER 29, 2021

“A buffer overflow vulnerability was discovered in the products listed in the “Affected Products” section of this bulletin. This issue could be used to potentially gain insight into arbitrary areas of the product’s memory.” ” reads the security advisory published by Zoom. .

Security 125

Security Information Security IT 125

Thales Cloud Protection & Licensing

APRIL 3, 2024

If you are looking to know the full list of differences between 140-2 and 140-3 and the benefits from the changeover, read our FIPS 140-3 webpage. For the full details, read the FIPS 140-3 Product Announcement on our Customer Support Portal that outlines where to get the latest firmware for the Luna Network and Luna PCIe models.

Compliance 133

Compliance Encryption Marketing Security 133

Security Affairs

MARCH 26, 2022

The Federal Communications Commission (FCC) added Kaspersky to its Covered List because it poses unacceptable risks to U.S. The Federal Communications Commission (FCC) added multiple Kaspersky products and services to its Covered List saying that they pose unacceptable risks to U.S. national security. national security.

Risk 98

Risk Security Communications Information Security 98

Security Affairs

SEPTEMBER 12, 2023

Adobe Patch Tuesday security updates (APSB23-34) addressed a critical zero-day vulnerability actively exploited in the wild in attacks on Adobe Acrobat and Reader products. Software giant Adobe is warning of a critical security vulnerability in the PDF Acrobat and Reader that is actively exploited in the wild.

Security 112

Security Information Security IT 112

Security Affairs

APRIL 8, 2024

.” Crowdfense is also offering many other payouts for less sophisticated zero-day exploits targeting multiple products, including Chrome and Safari browsers. In 2019 price list , the company offered $3 million for a zero-click remote code execution expploit for Android and iOS.

Government 109

Government IT Security Information Security 109

Schneier on Security

FEBRUARY 8, 2024

Over on Lawfare, Jim Dempsey published a really interesting proposal for software liability: “Standard for Software Liability: Focus on the Product for Liability, Focus on the Process for Safe Harbor.” They focus on process, while a liability regime should begin with a focus on the product—­that is, on outcomes.

Paper 102

Paper Cybersecurity Government Security 102

Security Affairs

APRIL 11, 2024

Microsoft Patches Tuesday security updates for April 2024 addressed 147 vulnerabilities in multiple products. “This is an odd one, as a ZDI threat researcher found this vulnerability being in the wild, although Microsoft currently doesn’t list this as exploited. I would treat this as in the wild until Microsoft clarifies.”

Marketing 114

Marketing Security IT Information Security 114

Security Affairs

JULY 13, 2022

IT giant Lenovo released security fixes to address three vulnerabilities that impact the UEFI firmware shipped with over 70 product models. CVE-2022-1891: A buffer overflow has been identified in the SystemLoadDefaultDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.

Security 132

Security IT Information Security 132

Schneier on Security

OCTOBER 21, 2020

The NSA released an advisory listing the top twenty-five known vulnerabilities currently being exploited by Chinese nation-state attackers. Most of the vulnerabilities listed below can be exploited to gain initial access to victim networks using products that are directly accessible from the Internet and act as gateways to internal networks.

Government 113

Government Access 113

DLA Piper Privacy Matters

AUGUST 8, 2022

On 26 May 2022, the TC260 released the Draft Requirements on Privacy Agreements for Internet Platforms, Products and Services (“ Draft Requirements ”) for public consultation. Personal Information Collection List : a list setting out the types of personal data collected or processed by services and business functions.

Privacy 94

Privacy Personal data Data collection Access 94